Sam Morrow 0c825b4233 fix(security): enforce HTTPS for gh-host/GITHUB_HOST to prevent cleartext credentials ...

GHES hosts accepted an http:// scheme, which was interpolated into every
REST/GraphQL/upload/raw/authorization URL. Authenticated requests would then
carry the bearer token/PAT over cleartext http, exposing it to network
interception and replay.

Add a central HTTPS check in parseAPIHost so no deployment can build
authenticated URLs over http, mirroring the existing GHEC behaviour. Permit
http only for loopback hosts (localhost, 127.0.0.1, ::1) so local development
against a dev server still works.

Closes github/copilot-mcp-core#1815

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

2026-08-14 13:53:02 +02:00

..

oauth_test.go

fix(security): enforce HTTPS for gh-host/GITHUB_HOST to prevent cleartext credentials

2026-08-14 13:53:02 +02:00

oauth.go

feat(oauth): add stdio OAuth 2.1 login core library (1/4) (#2704)

2026-06-26 11:59:35 +02:00